What types of authentication do you know?

Basic Authentication: Sending a username and password encoded in Base64 in the HTTP Authorization header. Unsafe if not used with HTTPS.

// Header example
Authorization: Basic username:password_base64

Digest Authentication: A more secure alternative to basic, uses hashing to prevent password interception.

Token-Based Authentication: The server issues a token (e.g., JWT) after successful login, which the client then sends with each request to verify identity.

// Header example
Authorization: Bearer <token>

OAuth (Open Authorization): An authorization protocol that allows third-party applications to access user resources on another service without sharing credentials. Versions 1.0 and 2.0 exist.

OpenID Connect (OIDC): An extension over OAuth 2.0 that adds authentication capabilities, i.e., user identity verification. Used for Single Sign-On.

API Key Authentication: Clients send a unique key in headers or request parameters for identification. Simpler than full OAuth but less flexible.

// Header or parameter example
X-API-Key: <api_key>

Session-Based Authentication: After login, the server creates a session and sends a session ID (usually in cookies). The client sends this ID with each subsequent request. Session state is stored on the server.

Two-Factor Authentication (2FA) and Multi-Factor Authentication (MFA): Require providing two (or more) different types of credentials from different categories: something the user knows (password), something the user has (phone, token), and something the user is (biometrics).